Read the docs
TI-2021-12350 Aliases CVE-2021-32682GHSA-wph3-44rj-92pr

Multiple vulnerabilities leading to RCE

Priority HIGH 79CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.

Why it matters now

EPSS 0.69934 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed studio-42/elfinder (Packagist): 2.1.59

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Studio-42elFinder= 2.1.58—No fix listedCNA
—studio-42/elfinder (Packagist)before 2.1.592.1.59Patch availableGHSA-wph3-44rj-92pr
  • elFinder VendorStudio-42 Affected = 2.1.58 Fixed in — No fix listed CNA
  • studio-42/elfinder (Packagist) Vendor— Affected before 2.1.59 Fixed in 2.1.59 Patch available GHSA-wph3-44rj-92pr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:*before 2.1.59VulnerableStd42
  • cpe:2.3:a:std42:elfinder:*:*:*:*:*:*:*:* Versions before 2.1.59 Vulnerable ·Std42

Remediation

  • Fix · GHSA-wph3-44rj-92pr studio-42/elfinder (Packagist) Fixed in 2.1.59 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32682
  2. 2026-10-03 Alias added: GHSA-wph3-44rj-92pr

References

Exploit 2

Patch 1

Advisory 2

Other 3

  • TI-2026-56500 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback CVSS 3.1HIGH 8.6
  • TI-2026-56501 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections CVSS 3.1MEDIUM 5.4
  • TI-2026-32450 elFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL) CVSS 3.1HIGH 8.8
  • TI-2026-56502 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE) CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences